| Any time you start an application or type a command on the command line, Microsoft Windows Server 2003 starts one or more processes to handle the related program. Generally , processes that you start in this manner are called interactive processes . That is, you start the processes interactively with the keyboard or mouse. If the application or program is active and selected, the related interactive process has control over the keyboard and mouse until you switch control by terminating the program or selecting a different one. When a process has control, it's said to be running in the foreground . Processes can also run in the background . With processes started by users, this means that programs that aren't currently active can continue to operate ”only they generally aren't given the same priority as the active process. You can also configure background processes to run independently of the user logon session; the operating system usually starts such processes. An example of this type of background process is a batch file started with an AT command. The AT command tells the system to run the file at a specified time, and (if permissions are configured correctly) the AT command can do so regardless of whether a user is logged on to the system. Task Manager The key tool you'll use to manage system processes and applications is Task Manager. You can access Task Manager using any of the following techniques: -
Press Ctrl+Shift+Esc -
Press Ctrl+Alt+Del and then click the Task Manager button -
Type taskmgr into the Run utility or a command prompt -
Right-click the taskbar and select Task Manager from the shortcut menu Techniques you'll use to work with Task Manager are covered in the following sections. Administering Applications Task Manager's Applications tab is shown in Figure 3-1. This tab shows the status of the programs that are currently running on the system. You can use the buttons on the bottom of this tab as follows : -
Stop an application by selecting the application and then clicking End Task. -
Switch to an application and make it active by selecting the application and then clicking Switch To. -
Start a new program by selecting New Task, and then enter a command to run the application. New Task functions like the Start menu's Run utility. Tip The Status column tells you if the application is running normally or if the application has gone off into the ozone. A status of Not Responding is an indicator that an application might be frozen, and you might want to end its related task. However, some applications might not respond to the operating system during certain process- intensive tasks . Because of this, you should be certain the application is really frozen before you end its related task.
Figure 3-1. The Applications tab of the Windows Task Manager shows the status of programs currently running on the system.  Right-Clicking a Listing Right-clicking an application's listing in the Windows Task Manager displays a shortcut menu that allows you to -
Switch to the application and make it active -
Bring the application to the front of the display -
Minimize and maximize the application -
Tile or cascade the application -
End the application -
Go to the related process in the Processes tab Note The Go To Process is very helpful when you're trying to find the primary process for a particular application. Selecting this option highlights the related process in the Processes tab.
Administering Processes The Task Manager Processes tab is shown in Figure 3-2. This tab provides detailed information about the processes that are running. By default, the Processes tab shows only processes run by the operating system, local services, network services, and the interactive user. The interactive user is the user account logged on to the local console. To see processes run by remote users, such as those connecting using a remote desktop connection, you'll need to select Show Processes From All Users. Figure 3-2. The Processes tab provides detailed information on running processes.  The fields of the Processes tab provide lots of information about running processes. You can use this information to determine which processes are hogging system resources, such as CPU time and memory. The fields displayed by default are: -
Image Name The name of the process or executable running the process -
User Name The name of the user or system service running the process -
CPU The percentage of CPU utilization for the process -
Mem Usage The amount of memory the process is currently using If you click View and choose Select Columns, you'll see a dialog box that will let you add columns to the Processes view. When you're trying to troubleshoot system problems using process information, you might want to add these columns to the view: -
Base Priority Priority determines how much of the system resources are allocated to a process. To set the priority of a process, right-click the process, choose Set Priority, and then select the new priority. Priorities are Low, Below Normal, Normal, Above Normal, High, and Real-Time. Most processes have a normal priority by default. The highest priority is given to real-time processes. -
CPU Time The total amount of CPU cycle time used by the process since it was started. To quickly see the processes that are using the most CPU time, display this column and then click the column header to sort process entries by CPU Time. -
Handle Count The total number of file handles maintained by the process. Use the handle count to gauge how dependent the process is on the file system. Some processes, such as those used by Microsoft Internet Information Services (IIS), have thousands of open file handles. Each file handle requires system memory to maintain. -
I/O Reads, I/O Writes The total number of disk input/output (I/O) reads or writes since the process was started. Together, the number of I/O reads and writes tell you how much disk I/O activity there is. If the number of I/O reads and writes is growing disproportional to actual activity on the server, the process might not be caching files or file caching might not be properly configured. Ideally, file caching will reduce the need for I/O read and writes. -
Page Faults A page fault occurs when a process requests a page in memory and the system can't find it at the requested location. If the requested page is elsewhere in memory, the fault is called a soft page fault . If the requested page must be retrieved from disk, the fault is called a hard page fault . Most processors can handle large numbers of soft faults. Hard faults, however, can cause significant delays. -
Paged Pool, Non-paged Pool The paged pool is an area of system memory for objects that can be written to disk when they aren't used. The non-paged pool is an area of system memory for objects that can't be written to disk. You should note processes that require a high amount of nonpaged pool memory. If there isn't enough free memory on the server, these processes might be the reason for a high level of page faults. -
Peak Memory Usage The highest amount of memory used by the process. The change or delta between current memory usage and peak memory usage is important to note as well. Applications, such as Microsoft SQL Server, that have a high delta between base memory usage and peak memory usage might need to be allocated more memory on startup so that they perform better. -
Thread Count The current number of threads that the process is using. Most server applications are multithreaded. Multithreading allows concurrent execution of process requests. Some applications can dynamically control the number of concurrently executing threads to improve application performance. Too many threads, however, can actually reduce performance, as the operating system has to switch thread contexts too frequently. If you examine processes running in Task Manager, you'll note a process called System Idle Process. You can't set the priority of this process. Unlike other processes that track resource usage, System Idle Process tracks the amount of system resources that aren't used. Thus, a 99 in the CPU column for the System Idle Process means 99 percent of the system resources currently aren't being used. As you examine processes, keep in mind that a single application might start multiple processes. Generally, these processes are dependent on a central process, and from this main process a process tree containing dependent processes is formed . You can find the main process for an application by right-clicking the application in the Applications tab and selecting Go To Process. When you terminate processes, you'll usually want to target the main application process or the application itself rather than dependent processes. This ensures that the application is stopped cleanly. To stop the main application process and dependent processes, you have several choices. You can: -
Select the application on the Applications tab, and then click End Task -
Right-click the main application process on the Processes tab, and then select End Process -
Select the main or a dependent process on the Processes tab, and then select End Process Tree Viewing and Managing System Performance The Task Manager Performance tab provides an overview of CPU and memory usage. As shown in Figure 3-3, the tab displays graphs as well as statistics. This information gives you a quick check on system resource usage. For more detailed information, use Performance Monitor, as explained later in this chapter. Figure 3-3. The Performance tab provides a quick check on system resource usage.  Graphs on the Performance Tab The graphs on the Performance tab provide the following information: -
CPU Usage The percentage of processor resources being used currently. -
CPU Usage History A history graph of CPU usage plotted over time. The update speed determines how often the graph is updated. -
PF Usage The amount of the paging file (or virtual memory) being used by the system currently. -
Page File Usage History A history graph of paging file usage plotted over time. Tip To view a close-up of the CPU graphs, double-click within the Performance tab. Double-clicking again returns you to normal viewing mode. If CPU usage is consistently high, even under average usage conditions, you might want to perform more detailed performance monitoring to determine the cause of the problem. Memory is often a source of performance problems, and you should rule it out before upgrading or adding CPUs. For more details, see the section of this chapter entitled "Tuning System Performance."
Customizing and Updating the Graph Display To customize or update the graph display, use the following options on the View menu: -
Update Speed Allows you to change the speed of graph updating as well as to pause the graph. Updates occur once every four seconds for Low, once every two seconds for Normal, and twice per second for High. -
CPU History On multiprocessor systems, allows you to specify how CPU graphs are displayed. You can, for example, display one CPU in each graph or multiple CPUs in each graph. -
Show Kernel Times Allows you to display the amount of CPU time used by the operating system kernel. Usage by the kernel is shown in red plotting (as opposed to green plotting, which is used otherwise ). Beneath the graphs you'll find several lists of statistics. These statistics provide the following information: -
Commit Charge Provides information on the total memory used by the operating system. Total lists all physical and virtual memory currently in use. Limit lists the total physical and virtual memory available. Peak lists the maximum memory used by the system since bootup . If the difference between the total memory used and the peak memory used is consistently large, you might want to add physical memory to the system to improve performance. If the peak memory usage is within 10 percent of the Limit value, you might want to add physical memory and/or increase the amount of virtual memory. -
Kernel Memory Provides information on the memory used by the operating system kernel. Critical portions of kernel memory must operate in RAM and can't be paged to virtual memory. This type of kernel memory is listed as Nonpaged . The rest of kernel memory can be paged to virtual memory and is listed as Paged . The total amount of memory used by the kernel is listed under Total . -
Physical Memory Provides information on the total RAM on the system. Total shows the amount of physical RAM. Available shows the RAM not currently being used and available for use. System Cache shows the amount of memory used for system caching. If the server has very little physical memory available you might need to add memory to the system. In general, you want the available memory to be no less than 5 percent of the total physical memory on the server. -
Totals Provides information on CPU usage. Handles shows the number of I/O handles in use. Threads shows the number of threads in use. Processes shows the number of processes in use. I/O throughput and disk performance have more of an impact on a system than a consistently high number of I/O handles has. Viewing and Managing Networking Performance The Task Manager Networking tab provides an overview of the network adapters being used by a system. You can use the information provided to quickly determine the percent utilization, link speed, and operational status usage of each network adapter configured on a system. If a system has one network adapter, the summary graph shown in Figure 3-4 details the network traffic on this adapter over time. If a system has multiple network adapters, the graph displays a composite index of all network connections, which represents all network traffic. By default, the graph displays only the network traffic total byte count. You can change this by clicking View, choosing Network History, and then enabling Bytes Sent, Bytes Received, or both. Bytes Sent are shown in red, Bytes Received in yellow, Bytes Total in green. Figure 3-4. Networking performance allows you to easily track network activity on the server.  The fields of the Networking tab provide lots of information about network traffic to and from the server. You can use this information to determine how much external traffic a server is experiencing at any time. The fields displayed by default are: -
Adapter Name Name of the network adapter in the Network Connections folder. -
Network Utilization Percentage of network usage based on the initial connection speed for the interface. For example, an adapter with an initial link speed of 100 megabits per second (Mbps) and current traffic of 10 Mbps would have a 10 percent utilization. -
Link Speed Connection speed of the interface as determined by the initial connection speed. -
State Operational status of network adapters. Real World Any time you see usage consistently approaching or over 50 percent of total capacity, you'll want to start monitoring the server more closely and might also want to consider adding additional network adapters. Plan any upgrade carefully ; there's a lot more planning required than you might think. Consider not only the implications for that server, but also for the network as a whole. You might also have connectivity issues if you exceed the allotted bandwidth of your service provider ”and it can often take several months to obtain additional bandwidth for external connections. | If you click View and choose Select Columns, you'll see a dialog box that will let you add columns to the Processes view. When you're trying to troubleshoot networking problems, you might want to add these columns to the view: -
Bytes Sent Throughput Percentage of current connection bandwidth used by traffic sent from the system -
Bytes Received Throughput Percentage of current connection bandwidth used by traffic received by the system -
Bytes Throughput Percentage of current connection bandwidth used for all traffic on the network adapter -
Bytes Sent Cumulative total bytes sent on the connection to date -
Bytes Received Cumulative total bytes received on the connection to date -
Bytes Total Cumulative total bytes on the connection to date Viewing and Managing Remote User Sessions Remote users can connect to systems using Terminal Services or Remote Desktop. Terminal Services allow remote terminal connections to systems. Remote Desktop allows you to remotely administer systems as if you were sitting at the keyboard. Remote Desktop connections are automatically enabled on Windows Server 2003 installations. One way to view and manage remote desktop connections is to use Task Manager. To do this, start Task Manager, and then select the Users tab. The Users tab shows interactive user sessions for both local and remote users. Each user connection is listed with the user account name, session ID, status, originating client computer, and session type. A user logged on to the local system is listed with Console as the session type. Other users have a session type that indicates the connection type and protocol, such as RDP-TCP for a connection using the Remote Desktop Protocol with TCP as the transport protocol. If you right-click user sessions, you have the following options: -
Connect Connects the user session if it's inactive. -
Disconnect Disconnects the user session, halting all user-started applications without saving application data. -
Log Off Logs the user off, using the normal logoff process. Application data and system state information are saved as during a normal log off. -
Remote Control Sets the hot keys used to end remote control sessions. The default hot keys are Ctrl+*. -
Send Message Sends a console message to users logged on to remote systems. |
![Microsoft Windows Server 2003 Administrator[ap]s Pocket Consultant](/icons/blank_book.jpg "Microsoft Windows Server 2003 Administrator[ap]s Pocket Consultant"){kind=icon}